Covenant Health is apologizing to its patients Monday after an unencrypted back-up hard drive containing over 3,000 digital images of more than 200 patients went missing.
"We made a mistake," Patrick Dumelie, Covenant Health’s president and CEO, said at a news conference on Monday.
"We did not hold up to our obligation to protect this information and for that we are very, very sorry."
The 3,600 missing photos and two videos are back-ups of images taken at the Misericordia between 2002 to 2010.
The missing folders and file names included the patient’s name and hospital number.
Four files also included some personal identification information but none of the files contained any financial information and Dumelie said identity theft is not a concern.
Still the fact that the hard drive was unencrypted has Alberta’s Information & Privacy Commissioner worried.
"My rant has been, portable device plus personal information equals encryption. This wasn’t a portable device. This was a hard drive from a desktop computer that had been made portable because they took it out of the desktop so you kind of come up with a variation here that I’m not sure what to do with," said Frank Work, Alberta’s privacy commissioner.
"Had it been a portable that hadn’t been encrypted, I’d be ranting again (but) do we have to go to encryption on every device?"
Some of the images were very personal, showing stillborn babies and the videos showed surgeries.
"This may be a one in a million freak accident but still I imagine the anguish, the sorrow or concern it’s going to cause the people involved, the encryption might have been worth it," Work said.
Covenant staff spent the weekend contacting the 233 impacted patients. So far, 147 patients have been notified.
Dumelie says it doesn’t appear the hard drive was stolen.
"We have no indication that it was intentional, or theft, there was no break-in," he said.
And he adds that Covenant Health is now taking steps to change how it handles patient images.
"I also want to reassure anyone who comes to our facilities for care, changes have been made and we are working with staff and the Office of the Information and Privacy Commissioner to prevent this from happening again."
The missing images, which were back-ups of originals taken at the Misericordia, were not stored according to Covenant Health’s policies on the protection of information.
All of the originals of the missing images are now uploaded to a secure server meeting privacy and information technology standards and Covenant Health is reviewing its practices and providing staff education and training around secure image storage.
The folders containing patient images were from the following areas:
The unencrypted hard drive was last seen Jan. 17. Covenant Health says the drive was placed under a desk while other equipment in the office was being moved to a new location.
Staff noticed the drive was missing on Jan. 28 and an investigation launched shortly after.
Covenant Health Protective Services say there appears to be no sign of a break-in or indication of theft and an investigation is still ongoing.
If people had an image taken or suffered a late-term pregnancy loss while they were a patient at the Misericordia Community Hospital between 2002 and 2010 and have concerns, they are asked to call 1-855-735-9900.
The line will be staffed from 3:00 p.m. until 8:00 p.m. Monday to Friday until March 25.
Covenant Health is Canada’s largest Catholic healthcare provider and serves 11 Albertan communities.
Comments